5
responses

on my mssql server i installed nxlog enterprise version and i want that audit sharepoint content database i configured nxlog.conf with next code Module im_odbc ConnectionString Driver={ODBC Driver 13 for SQL Server}; \ Server=dri-spsqlph; Database=WSS_Content_lok; \ Trusted_Connection=yes SQL SELECT Occurred as id, * FROM dbo.AuditData WHERE Occurred > ? IdIsTimestamp TRUE # Fix time zone and set $EventTime $EventTime = parsedate(strftime($id, '%Y-%m-%d %H:%M:%SZ')); delete($id); Module om_udp Host 192.168.99.52 Port 514 Exec to_syslog_bsd();

Path audit_db => out but when i restart nxlog service in nxlog i receive error

ERROR apr_sockaddr_info failed for ENTER_MANAGEMENT_ADDRESS_HERE:4041; No such host is known.

why?

AskedMarch 2, 2018 - 3:16pm

Answer (1)

Hello,

in the last line of t he default nxlog.conf there is a reference to the nxlog manager configuration options: include %CONFDIR%/log4ensics.conf

This configuration contains the nxlog-manager address, and show the place where it should be written as ENTER_MANAGEMENT_ADDRESS_HERE:4041

If you do not use nxlog-manager, simply remove the include from the nxlog.conf, or configure it to the nxlog-manager.

Peter

Comments (4)

  • gogi100's picture

    I removed the include from the nxlog.conf, but in nxlog log file i receive message

    2018-03-04 15:43:28 INFO nxlog-3.2.2016-trial started

    2018-03-04 15:43:28 INFO im_odbc successfully connected to the database

    my log server does not receives log message from nxlog

  • tape's picture

    Do you use nxlog-manager to handle the configuration, or you edited the configuration of nxlog by hand? According to the log you copied, im_odbc successfully connected to the database server, but this is too few informations.